CVE-2026-71461

HostList.list() catches bare Exception and returns str(e)
              verbatim. Via host_filter, any authenticated user triggers
              Django FieldError (leaking complete Host model relation
              graph including internal reverse accessors) or PostgreSQL
              DataError (leaking raw database error strings). Two
              primitives: credential__search=x dumps ORM schema,
              name__regex=[bad reflects PostgreSQL errors.